OCR Director: The Cost of Doing Nothing Is Very High

OCR Acting Director Paula Stannard took the stage at HIMSS 2026 to deliver a pointed defense of the agency's proposed HIPAA Security Rule update — and to push back on industry critics who have argued the proposed requirements are too expensive and technically demanding for smaller healthcare organizations.

"The cost of doing nothing is very high," Stannard told the audience. "We have seen hospitals divert ambulances. We have seen surgeries canceled. We have seen patients harmed. That is the cost of the status quo."

Background: The Proposed Rule

HHS published a Notice of Proposed Rulemaking in January 2025 that would represent the first substantive update to the HIPAA Security Rule since 2013. The proposed rule attracted more than 4,000 public comments, many from hospital associations, small provider groups, and health IT vendors concerned about implementation costs.

The most contested provision is the elimination of the "addressable" specification category. Under current rules, certain safeguards are designated "addressable," meaning covered entities can choose not to implement them if they document a reasonable basis for that decision. The proposed rule would eliminate this distinction, making all implementation specifications required.

Other significant proposals include mandatory multi-factor authentication for all access to electronic protected health information, annual penetration testing and vulnerability scanning, network segmentation requirements, and more prescriptive incident response plan requirements.

"Not a Paperwork Exercise"

Stannard was direct about OCR's intentions. She framed the proposed rule not as a paperwork exercise but as a direct response to documented patient harm.

"We are not asking for binders and checkboxes," she said. "We are asking you to actually implement the controls that prevent ransomware from shutting down your hospital."

She pointed to high-profile incidents — including ransomware attacks that forced hospital systems to divert emergency patients and cancel procedures — as evidence that the current rule's flexibility has been exploited.

Industry Response

Trade groups including the American Hospital Association and HIMSS itself have urged HHS to reconsider some of the more prescriptive provisions, particularly mandatory penetration testing timelines and MFA requirements for legacy clinical systems that were not designed with modern authentication in mind.

HIMSS submitted formal comments arguing that a phased implementation timeline of at least two years would be necessary for many members, and that small and rural providers would need additional technical assistance and safe harbors.

Stannard acknowledged the concerns but indicated that OCR is not inclined to weaken the core technical requirements.

"We hear you on implementation timelines," she said. "We are less sympathetic to the argument that you should not have to implement multi-factor authentication because it is hard."

What Covered Entities Should Do Now

The final rule has not yet been published. However, OCR has made clear that it views the proposed requirements as reflective of current best practices — meaning that enforcement actions under the existing rule may increasingly benchmark against the proposed standards even before they become final.

Key steps to take now:

• Audit your MFA coverage. Identify all systems that access ePHI and determine which do not currently support or enforce MFA.
• Review your risk analysis. The proposed rule requires documented risk analysis updates whenever the environment changes materially. Many organizations have not updated their risk analysis since before the COVID-era shift to remote access.
• Map your network segmentation. Determine whether ePHI systems are isolated from general corporate networks in a way that would limit the spread of ransomware.
• Test your incident response plan. The proposed rule requires tabletop and technical exercises, not just a documented plan on a shelf.